Re: [PATCH bpf v4] xskmap: reject TX-only AF_XDP sockets

[Jason Xing]

On Fri, May 8, 2026 at 10:43 PM Linpu Yu <linpu5433@xxxxxxxxx> wrote:
>
> XSKMAP entries are used as redirect targets for incoming XDP frames.
> A TX-only AF_XDP socket lacks an Rx ring and cannot handle redirected
> traffic, but xsk_map_update_elem() currently allows such sockets to
> be inserted into the map.
>
> Redirecting packets to such a socket on the veth generic-XDP path
> causes a kernel crash in xsk_generic_rcv().
>
> This became possible after xsk_is_setup_for_bpf_map() was removed from
> the XSKMAP update path, which allowed bound TX-only sockets to be
> inserted into the map.
>
> Reject TX-only sockets during XSKMAP updates to avoid the crash.
> They remain fully operational for pure Tx purposes outside XSKMAP.
>
> Fixes: 968be23ceaca ("xsk: Fix possible segfault at xskmap entry insertion")
> Reported-by: Juefei Pu <tomapufckgml@xxxxxxxxx>
> Reported-by: Yuan Tan <yuantan098@xxxxxxxxx>
> Reported-by: Xin Liu <bird@xxxxxxxxxx>
> Signed-off-by: Yifan Wu <yifanwucs@xxxxxxxxx>
> Signed-off-by: Linpu Yu <linpu5433@xxxxxxxxx>

Even though AI suggested using EOPNOTSUPP instead, prior to this
thread, I pointed out ENOBUFS makes more sense because it is identical
to how xsk_recvmsg() detects the failure of the rx ring. If needed, we
can cook a follow-up patch to replace that in __xsk_recvmsg().

It looks good to me:
Reviewed-by: Jason Xing <kerneljasonxing@xxxxxxxxx>

Thanks,
Jason

> ---
> Changes in v4:
> - retarget the patch from bpf-next to bpf
> - resend after no feedback
>
>  net/xdp/xskmap.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/net/xdp/xskmap.c b/net/xdp/xskmap.c
> index afa457506274..3bff346308d0 100644
> --- a/net/xdp/xskmap.c
> +++ b/net/xdp/xskmap.c
> @@ -184,6 +184,10 @@ static long xsk_map_update_elem(struct bpf_map *map, void *key, void *value,
>         }
>
>         xs = (struct xdp_sock *)sock->sk;
> +       if (!READ_ONCE(xs->rx)) {
> +               sockfd_put(sock);
> +               return -ENOBUFS;
> +       }
>
>         map_entry = &m->xsk_map[i];
>         node = xsk_map_node_alloc(m, map_entry);
> --
> 2.54.0